Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage Campaign Deploying Nuso, LampoRAT, BlackBeard, Phoenix, and UDPGangster Malware
Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage (TL-2026-0238), also tracked as Operation Olalampo, is a high-severity advanced persistent threat campaign, first published 2026-03-16. It is attributed to MuddyWater (Iran) with high confidence, affects Multiple Microsoft Office (Word, Excel), maps to 33 MITRE ATT&CK techniques (T1005, T1018, T1027), and is covered by 9 detection rules and 53 indicators of compromise.
Key facts for TL-2026-0238
- Threat ID
- TL-2026-0238
- Also known as
- Operation Olalampo
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-16
- Last reviewed
- 2026-03-16
- Attribution
- MuddyWater
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government, military, energy, maritime, aviation, telecom, finance, critical-infrastructure
- Target regions
- Middle East, Israel, UAE, Saudi Arabia, Turkey, Oman, Egypt, Azerbaijan, Turkmenistan, Hungary, Europe, Central Asia
- Detection rules
- 9
- Indicators of compromise
- 53
Malware and tooling in Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
Malware and tooling: BlackBeard, GhostBackDoor, LampoRAT, Nuso, Phoenix v4, UDPGangster, Telegram Bot API
Iranian threat group Boggy Serpens (MuddyWater), a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), has launched an extensive AI-enhanced cyberespionage campaign spanning August 2025 through February 2026. The operation deploys six custom malware families including the Nuso HTTP backdoor, Rust-based LampoRAT with Telegram C2, BlackBeard backdoor with AES-256-GCM encryption, Phoenix v4, UDPGangster with UDP-based C2, and the newly documented GhostBackDoor. Targets span government, military, energy, maritime, aviation, telecom, and finance sectors across the Middle East, Central Asia, and Europe.
How Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage works
Boggy Serpens, tracked by Palo Alto Networks Unit 42 as an Iranian state-sponsored threat actor subordinate to the Ministry of Intelligence and Security (MOIS), has significantly evolved its cyberespionage operations in a campaign running from August 2025 through February 2026. Active since at least 2017 and also known as MuddyWater, the group has shifted from its historical reliance on legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect, and SimpleHelp toward deploying custom-built malware families with sophisticated capabilities.
The campaign introduces six distinct malware families representing a major leap in tooling sophistication:
**Nuso (HTTP_VIP)** — A custom HTTP backdoor that uses dynamic API resolution to avoid Import Address Table (IAT) inspection. Commands are delivered via HTTP status codes: 201/204 trigger shell command execution, 210/222 update beacon intervals, and 350/404 signal termination. Data exfiltration occurs through bit-rotated custom HTTP headers (X-Computer-Name, X-Username). PDB paths containing the username 'nuso' and anti-analysis strings ('fuckAnalyzor') reveal developer artifacts.
**LampoRAT (Olalampo/CHAR)** — A Rust-based remote access trojan that masquerades as Kaspersky antivirus (avp.exe) with embedded Kaspersky metadata strings. It uses the Telegram Bot API for command and control with a hardcoded bot token, enabling malicious traffic to blend with legitimate encrypted HTTPS communications. The malware supports shell execution via cmd.exe and directory navigation. Notably, its use of emoji-based status indicators (checkmarks, crosses) in reporting strongly suggests AI-assisted code generation, as large language models frequently include such visual indicators by default.
**BlackBeard** — A Rust-based backdoor tracked by the Israeli National Cyber Directorate. It communicates with stratioai[.]org using the reqwest HTTP crate and encrypts exfiltrated system data with AES-256-GCM (hardcoded key and IV). HTTP response codes 201/202 trigger payload drops to C:\ProgramData\WebDeepPlayer.scr, while 418 signals exit. BlackBeard achieves persistence through a novel technique: registering a custom .wdlp file association in the registry (HKCU\Software\Classes\.wdlp) that triggers WebDeepPlayer.scr execution, combined with dropping Oregon.wdlp in the startup folder. It also scans %PROGRAMDATA% for 15+ security products to fingerprint the target environment.
**Phoenix v4 (Mononoke)** — The evolution of the group's established Phoenix backdoor family. It employs property-based payload encapsulation in VBA UserForm1.TextBox1 controls, hex-shift rotation cipher decryption, and a drop-rename-execute workflow (writing payloads as .log or .txt files before renaming to .exe). Phoenix implements both WMI (Win32_Process.Create) and Windows API (CreateProcessW) execution to decouple from Office parent processes, evading parent-child process monitoring. It includes a brute-force CPU stalling function executing 100+ million operations to timeout automated analysis tools.
**UDPGangster** — A lightweight backdoor using a custom UDP-based C2 protocol on non-standard ports (1269/1259). It features anti-analysis detection of research environments and delivers commands via byte prefixes (0x0A for named pipe creation). Reconnaissance capabilities include nslookup, ipconfig, dir, and Quser commands. Live operator interaction was observed approximately 12 hours post-infection at ~17:00 Iranian time. Distinct PDB path usernames (gangster, piper, surge) map to specific target sectors: Israel aviation, Azerbaijan finance, and Israel telecom respectively.
**GhostBackDoor** — A newly documented advanced implant enabling remote control and file access, deployed via personalized social engineering lures.
The campaign's initial access vector consistently relies on spear-phishing with malicious macro-enabled Office documents distributed from compromised legitimate accounts, including Omani Ministry of Foreign Affairs and internal corporate email accounts. This technique achieves negative spam confidence levels (SCL -1), bypassing reputation-based email filtering. Documents use blurred content overlays with 'older version' messages to trick users into clicking 'Enable Content', triggering VBA macro execution.
Four distinct attack waves were documented against a single UAE-based energy and maritime company with strategic ties to Saudi Aramco: an engineering-themed campaign (August 2025), financial department targeting with Excel lures (January 2026), personalized Air Arabia flight reservation lures using exfiltrated passenger data (January 2026), and operational logistics documents delivering the new Nuso backdoor (February 2026).
Boggy Serpens also operates a custom-built mass email orchestration platform observed on 157.20.182[.]75:5000, providing a Python web interface for automated phishing delivery with granular control over sender identities, target lists, SMTP configuration, and attachment management.
The campaign demonstrates operational overlaps with Evasive Serpens (Lyceum/OilRig subgroup), indicating shared resources and intelligence coordination within Iran's broader cyber threat landscape. The group's integration of AI-assisted development workflows, particularly evident in LampoRAT's emoji-based logging, enables parallel development tracks that sustain high operational tempo across multiple simultaneous campaigns.
MITRE ATT&CK techniques used in TL-2026-0238
collection
T1005 Data from Local System; T1115 Clipboard Data
discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel
defense-impairment
initial-access
T1199 Trusted Relationship; T1566 Phishing
privilege-escalation
T1546 Event Triggered Execution
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1555 Credentials from Password Stores
resource-development
Affected products and versions in Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
- Multiple — Microsoft Office (Word, Excel)
Vulnerable versions: All macro-enabled versions - Multiple — Windows Operating Systems
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Multiple — Government email infrastructure
Vulnerable versions: Compromised Omani MFA, Turkish MFA, internal corporate accounts - Multiple — Energy and maritime sector IT systems
Vulnerable versions: UAE-based energy/marine company with Saudi Aramco ties
Remediation for Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
Immediate actions
- Block all identified C2 IPs at perimeter firewalls: 157.20.182.75, 64.7.198.12, 46.101.36.39, 159.198.68.25, 159.198.66.153
- Block all identified C2 domains at DNS/proxy: stratioai.org, bootcamptg.org, codefusiontech.org, screenai.online, and all listed infrastructure domains
- Disable Office macro execution for users who do not require it via Group Policy
- Hunt for identified file hashes across endpoint fleet using EDR
- Search for .wdlp file extension creation in registry and startup folders
- Monitor for processes named avp.exe not originating from legitimate Kaspersky installation paths
- Block Telegram Bot API endpoints (api.telegram.org) at corporate proxy if not business-required
Workarounds
- Restrict macro-enabled document execution to signed macros only
- Block execution of .scr files from ProgramData and startup directories
- Implement email attachment sandboxing for Office documents
- Disable WMI remote process creation where not operationally required
Longer-term hardening
- Deploy behavioral EDR with process hollowing (RunPE) detection capabilities
- Implement DMARC, DKIM, and SPF enforcement to detect compromised account abuse
- Enable conditional access policies requiring MFA for all email accounts
- Deploy network detection for UDP-based C2 traffic on non-standard ports
- Implement application whitelisting to prevent execution from Public/ProgramData directories
- Conduct regular compromise assessments for accounts with access to sensitive infrastructure
Timeline of Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
- Boggy Serpens (MuddyWater) first identified as active threat group attributed to Iranian MOIS
- Boggy Serpens targeted Technion Israel Institute of Technology masquerading as DarkBit ransomware gang to mask state-sponsored origins
- First phishing document observed in the current campaign wave, marking the start of Operation Olalampo activities
- Early-stage phishing document deployed as campaign tooling is tested and refined
- Transfer receipt themed phishing document (#27790) deployed against targets
- Wave 1 attack against UAE energy/marine company using engineering-themed subsea pipeline DPR document delivering Phoenix v4 backdoor
- Compromised Omani MFA and Turkish MFA accounts used to distribute Online Seminar lures targeting government officials with Sustainable Peace theme
- AIC_2025 themed phishing document deployed in continued campaign operations
- Middle East and Maritime Economy themed phishing documents and sondouq.doc lures deployed targeting maritime and finance sectors
- Mass email orchestration platform observed active on 157.20.182.75:5000 providing automated phishing delivery infrastructure
- Webinar.doc campaign deployed; Israeli INCD reports MuddyWater internal account compromise using HR and webinar lures against Israeli organizations
- Israeli National Cyber Directorate publishes advisory on MuddyWater targeting Israeli organizations via internal account hijacking
- Turkmenistan telecommunications provider targeted via compromised internal account distributing Cybersecurity.doc phishing lure
- Operation Olalampo formally observed with deployment of GhostFetch, HTTP_VIP, CHAR (LampoRAT), and GhostBackDoor malware tools
- Wave 2 and 3 against UAE company: financial Excel lure targeting finance/supply chain departments and personalized Air Arabia flight reservation lure delivering GhostBackDoor
- Wave 4 against UAE company: Consumption Report Excel document delivers new Nuso HTTP backdoor, representing latest malware family in the campaign
- Palo Alto Networks Unit 42 publishes comprehensive Boggy Serpens threat assessment detailing six malware families, AI-enhanced development, and multi-wave campaign
- As of 2026-05-29, this MuddyWater/Boggy Serpens (MOIS, Iran) espionage threat stays ACTIVE: the actor remains undisrupted and demonstrably operating, with March-May 2026 reporting (Help Net, The Register, The Hacker News, Rapid7) showing fresh campaigns (Dindoor backdoor, Teams false-flag, 9-country DLL side-loading). The discrete Operation Olalampo waves concluded their documented phase by Feb 2026, but the actor, malware families, and TTPs persist as live threats with no CVE to patch.
Sources cited for Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
- Unit 42 Boggy Serpens Threat Assessment
- HivePro - Operation Olalampo: MuddyWater Expanding Campaign Across MENA
- Group-IB - Unmasking MuddyWater New Malware Toolkit Driving International Espionage
- Israeli National Cyber Directorate - MuddyWater Internal Account Compromise Advisory
- Malpedia - MuddyWater Threat Actor Profile
- MITRE ATT&CK - MuddyWater Group Profile (G0069)
- Unit 42 Timely Threat Intel - Boggy Serpens AutodialDLL
- CISA - Iranian Government-Sponsored APT MuddyWater
Threats related to Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage
- MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled payloads in ongoing global espionage campaign
- Iranian-Aligned Cyber Mobilization — 60+ Groups Targeting US Critical Infrastructure ICS/SCADA with AI-Assisted Reconnaissance Post Iran-US Escalation (Feb 28, 2026)
- Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068)
- Iranian State-Aligned Global Cyber Operations Surge Amid Iran Conflict (MuddyWater/Seedworm Dindoor & Fakeset Campaign)
- APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting
Detection coverage for TL-2026-0238
As of 2026-03-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0238 across Splunk SPL, Microsoft KQL and Sigma, covering 53 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.